Overview

overview

10

Static

static

3

e8eca1a24d...18.exe

windows7-x64

10

e8eca1a24d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8eca1a24d0eb575beb2dc01b6d01b64_JaffaCakes118

  • Size

    292KB

  • Sample

    241213-admd1sskbx

  • MD5

    e8eca1a24d0eb575beb2dc01b6d01b64

  • SHA1

    a1f389cd0b9488685316462ccef24b6e972dda05

  • SHA256

    e82b397c6cb9555caeb62448771c6c2d1c1faee6969041bdca06e9b2eb1c087c

  • SHA512

    b65e589c4d60c69c08e29a65bc55f0b648bae209afbb422246554b8cb516699a2757a4abeea79111307c3657839b676a2384077980701935a14e8b474f7e02fa

  • SSDEEP

    6144:2DdmAid3w4AsdOty/2gfazN1qNsGoMbMESRzDKgI88/nLd:CEAidw4AS3/7fkb4oM4EADv8/nLd

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      e8eca1a24d0eb575beb2dc01b6d01b64_JaffaCakes118

    • Size

      292KB

    • MD5

      e8eca1a24d0eb575beb2dc01b6d01b64

    • SHA1

      a1f389cd0b9488685316462ccef24b6e972dda05

    • SHA256

      e82b397c6cb9555caeb62448771c6c2d1c1faee6969041bdca06e9b2eb1c087c

    • SHA512

      b65e589c4d60c69c08e29a65bc55f0b648bae209afbb422246554b8cb516699a2757a4abeea79111307c3657839b676a2384077980701935a14e8b474f7e02fa

    • SSDEEP

      6144:2DdmAid3w4AsdOty/2gfazN1qNsGoMbMESRzDKgI88/nLd:CEAidw4AS3/7fkb4oM4EADv8/nLd

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks